NISTIR 7298 Revision 1, Glossary of Key Information Security Terms

NIST IR 7298 Revision 1, Glossary of Key Information Security Terms
IT Security Investment – An IT application or system that is solely devoted to security. For
instance, intrusion detection systems (IDS) and public key
infrastructure (PKI) are examples of IT security investments.
SOURCE: SP 800-65
IT Security Metrics – Metrics based on IT security performance goals and objectives.
SOURCE: SP 800-55
IT Security Policy – The “documentation of IT security decisions” in an organization.
NIST SP 800-12 categorizes IT Security Policy into three basic
types:
1) Program Policy—high-level policy used to create an
organization’s IT security program, define its scope within the
organization, assign implementation responsibilities, establish
strategic direction, and assign resources for implementation.
2) Issue-Specific Policies—address specific issues of concern to the
organization, such as contingency planning, the use of a particular
methodology for systems risk management, and implementation
of new regulations or law. These policies are likely to require
more frequent revision as changes in technology and related
factors take place.
3) System-Specific Policies—address individual systems, such as
establishing an access control list or in training users as to what
system actions are permitted. These policies may vary from
system to system within the same organization. In addition, policy
may refer to entirely different matters, such as the specific
managerial decisions setting an organization’s electronic mail
(email) policy or fax security policy.
SOURCE: SP 800-35
IT Security Training – IT Security Training strives to produce relevant and needed security
skills and competencies by practitioners of functional specialties
other than IT security (e.g., management, systems design and
development, acquisition, auditing). The most significant difference
between training and awareness is that training seeks to teach skills,
which allow a person to perform a specific function, while awareness
seeks to focus an individual’s attention on an issue or set of issues.
The skills acquired during training are built upon the awareness
foundation, in particular, upon the security basics and literacy
material.
SOURCE: SP 800-50
Jamming – An attack in which a device is used to emit electromagnetic energy
on a wireless network’s frequency to make it unusable.
SOURCE: SP 800-48
Pg 104